CVE-2026-10086

This flaw lets a malicious person “hide” a script inside content that gets displayed in the web app. When another user views that page, their browser can run the script as if it came from GitLab—potentially exposing their session or actions.

This matters if you run GitLab and have users with developer-role permissions who can create or influence content that other users view in the web interface. The risk is higher when a victim user can be directed to view the attacker’s crafted content (user interaction is required). Exploitation depends on an attacker being able to interact with the vulnerable feature and, per the findings, being authenticated with developer-role permissions—reachability in the default configuration is not yet known.

This should be treated as an urgent patch because the weakness can execute code in another user’s browser session context (cross-site scripting) and involves authenticated developer-level access. While there’s no clear dated public reporting of exploitation and no public exploit code on record, GitLab has already provided fixed releases, and the most effective step is to upgrade now.